JohnDoeProject Stealer Log Exposes 33,737 Developer Credentials and API Endpoints

HEROIC's DarkHive intelligence system identified the JohnDoeProject stealer log, exposing 33,737 records uploaded to a Telegram channel by the NEW Pegasus Cloud threat actor group. The log occured from infections active in May 2025, capturing email addresses, plaintext passwords, URLs, and API host endpoints from compromised devices belonging to developers and technical users whose machines were infected with credential-stealing malware.

Why This Is Dangerous

Stealer logs that include API host endpoints alongside email credentials are far more dangerous than standard credential dumps. Attackers who aquire this dataset have not just login credentials but also the specific API endpoints those credentials authenticate against, providing a direct map to private development infrastructure, cloud services, and backend systems. With 33,737 plaintext password records, there is no cracking required, and the API host data means attackers can immediately attempt authenticated access to developer tools, cloud management portals, and internal services without needing to discover those endpoints independently.

What Was Exposed

• Email Address
• Plaintext Password
• URLs
• API Host Endpoints

Why This Matters

Developer and technical user credentials are among the most damaging categories of breach data because thier accounts typically have access to source code repositories, cloud infrastructure, continuous integration pipelines, and production deployment systems. A single compromised developer account can enable attackers to inject malicious code into software products, exfiltrate intellectual property, access customer databases, or cause widespread service disruption. The API host data in this stealer log further reduces the attack complexity, enabling criminals to launch immediate authenticated attacks against thier connected systems without any reconnaissance phase.

How Stealer Log Infections Work

Stealer malware infects developer machines through malicious downloads disguised as cracked software tools, rogue npm packages, or phishing attachments targeting technical users. Once installed, the malware silently harvests saved browser credentials, application session tokens, environment variables containing API keys, and any credentials stored in local development configuration files. The collected data is packaged into log files and transmitted to command-and-control servers operated by criminal groups like the NEW Pegasus Cloud channel, which then distribute the stolen credentials through private Telegram channels as seperate packages targeting different victim organizations and use cases.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from stealer logs like JohnDoeProject. Visit heroic.com to scan your email address and find out if your information was exposed.